| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2016-11-03 00:38:02.639812 | 2016-11-03 00:40:21.152172 | 138 seconds | 2.0-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win-xp-sp3 | win-xp-sp3 | VirtualBox | 2016-11-03 00:38:02 | 2016-11-03 00:40:20 |
File Details
| File name | 100621.pdf | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 969411 bytes | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PDF document, version 1.7 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | C81A14A1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | e3f5ef4fa17b4e08388ae4b0e2373728 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | c201fc4252c97aabad9e13e8c4e064708cce150f | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | 5e77d181d45156a17423a7a9d8be59635c3425003a35957f3ccf973bf4a1240b | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | 65142c9d1ed5e76e4f38453bfc49c8211b1c9ca182436e7eb42a766fb2e69f1b60b9c97e3393cedf843884f7c9595d9266678a2b4589074e07edd997a69aaf14 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | 12288:ajvrEOfzscDUseU1CWCD/LdDB1LbWDFhg1hfqXT0IakRo6AX0WP1HZ81DKvm9PeY:ajDdfwc3eVD1/MDICgEAEWhLm92nvm | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara | None matched | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2016-10-27 07:25:20 Detection Rate: 39/55 (Expand)
|
Signatures
Screenshots
Static Analysis
Strings
%PDF-1.7
38 0 obj
<</Linearized 1/L 969411/O 43/E 4681/N 1/T 969056/H [ 495 211]>>
endobj
49 0 obj
<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<224C58AFBB383842BD3B41CD196C7E5A><73B72ED162E19748865B44E090FB245D>]/Index[38 41]/Info 37 0 R/Length 68/Prev 969057/Root 39 0 R/Size 79/Type/XRef/W[1 2 1]>>stream
endstream
endobj
startxref
78 0 obj
<</B 122/C 100/Filter/FlateDecode/I 146/Length 113/S 39/V 77>>stream
endstream
endobj
39 0 obj
<</AcroForm 50 0 R/Extensions<</ADBE<</BaseVersion/1.7/ExtensionLevel 3>>>>/Lang(zh-cn)/MarkInfo<</Marked true>>/Metadata 14 0 R/Names 51 0 R/Pages 27 0 R/PieceInfo 29 0 R/StructTreeRoot 24 0 R/Type/Catalog>>
endobj
40 0 obj
<</Filter[/FlateDecode]/Length 405>>stream
endstream
endobj
41 0 obj
<</Filter[/FlateDecode]/Length 274>>stream
C`u!)S
N(;a,r
endstream
endobj
42 0 obj
<</Filter[/FlateDecode]/Length 562>>stream
Y~@1%4
endstream
endobj
43 0 obj
<</Annots 56 0 R/Contents 47 0 R/CropBox[0.0 0.0 595.0 842.0]/LastModified(D:20100601172011+08'00')/MediaBox[0.0 0.0 595.0 842.0]/Parent 27 0 R/PieceInfo 74 0 R/Resources<</XObject<</Fm0 48 0 R>>>>/Rotate 0/Type/Page>>
endobj
44 0 obj
<</BBox[0.0 0.0 38.6939 32.9849]/Filter/FlateDecode/Length 297/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ExtGState<</GS0 58 0 R>>/ProcSet[/PDF/ImageC]/XObject<</Im0 45 0 R>>>>/Subtype/Form>>stream
endstream
endobj
45 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/FlateDecode/Height 66/Length 42/Subtype/Image/Width 79>>stream
endstream
endobj
46 0 obj
<</Filter/FlateDecode/First 212/Length 962/N 28/Type/ObjStm>>stream
endstream
endobj
47 0 obj
<</Length 12>>stream
/Fm0 Do
endstream
endobj
48 0 obj
<</BBox[108.0 72.0 487.0 770.0]/Filter/FlateDecode/FormType 1/LastModified 60 0 R/Length 10/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/PieceInfo 64 0 R/Resources<<>>/Subtype/Form/Type/XObject>>stream
endstream
endobj
1 0 obj
<</Filter[/FlateDecode]/Length 152/Type/EmbeddedFile>>stream
%)`*6~~
endstream
endobj
2 0 obj
<</Filter[/FlateDecode]/Length 673/Type/EmbeddedFile>>stream
T\aSMz"
S%%m=%}w
endstream
endobj
3 0 obj
<</Filter[/FlateDecode]/Length 2027/Type/EmbeddedFile>>stream
r46cWz
]S_~ho
LLglj-\
J3feI"T
` X-SI)
endstream
endobj
4 0 obj
<</Filter[/FlateDecode]/Length 149/Type/EmbeddedFile>>stream
endstream
endobj
5 0 obj
<</Filter[/FlateDecode]/Length 801/Type/EmbeddedFile>>stream
endstream
endobj
6 0 obj
<</Filter[/FlateDecode]/Length 154/Type/EmbeddedFile>>stream
endstream
endobj
7 0 obj
<</Filter[/FlateDecode]/Length 384/Type/EmbeddedFile>>stream
endstream
endobj
8 0 obj
<</Filter[/FlateDecode]/Length 63/Type/EmbeddedFile>>stream
endstream
endobj
9 0 obj
<</Filter[/FlateDecode]/Length 20/Type/EmbeddedFile>>stream
endstream
endobj
10 0 obj
<</Filter/FlateDecode/First 41/Length 871/N 6/Type/ObjStm>>stream
y~3j"#Q|
endstream
endobj
11 0 obj
<</Filter/FlateDecode/First 17/Length 90/N 3/Type/ObjStm>>stream
22Q0P02U06V02S03S
endstream
endobj
12 0 obj
<</DL 53345/Filter/FlateDecode/Length 27177/Params<</CheckSum(M
)/CreationDate(D:20100611232327+08'00')/ModDate(D:20100612003913+08'00')/Size 53345>>/Subtype/application#2Fx-shockwave-flash>>stream
.--M(ML
rKydV=/
p9$n9f
@09x!7uhw
i#Sq&R
wV,hPU
~.8yu\
y 1bgt
H;&\3^b
=rLnV]
#6+gk}
ZM6"mY
e.pw#) c
^jv6qa"_
E;-d:'
dA5HAOp
]bT2]>
.]tT2K6?
'V 6Ct
"/}qJ^J
(f82;+
1_?3+e
uaE9Wj
Ud6H_O
/Oc}yl
7/iiQy
Jw=MdYC
o12$.FX7!
<K;%fg
Xy9+sRX
3et'Y'$
{}t0z
#`,\KA":
],rVU"
mdaHld
u$9%L>
2@^WOF
K:}2buI9
L;avp-
E~TsD4
>8m,he
2!GD5f
s0,V58
cTxT*>
Ho1[|
`Kx s?aq
endstream
endobj
13 0 obj
<</Filter[/FlateDecode]/Length 926269>>stream
aM7XGN
100621.PDF
}z;zzz
FIIIIIIIIIIIII
TlT^ToT]
IIIIIIII
TlT^ToT]
FIIIII
iyzznf
3xv yz
zzzxv yz
LFIIIIIIIIIIII
GlV{zz
LFIIIIIIII
En}IIIIIIII
FIIIIIIIIIII
3xv yz
zzzxv yz
LFIIIIIIIIIII
ymLrzz
jHYDyO
jHYDIJ_
BL[GLE
zzzzzzzzu
AFsvVv|
`]]6iT
0_,/D9
a<,m\geB
n^Pmn)
Bv,9f?
M|2f~.~
h7Y@j
y[jxshI
rRnnV"v~h
NvpyxpBpl
fFhvNV>
{q}sbB
b>f|pv|2
bv`x`xb
DFyqv~~|^F`Nnl
Rbvp`wp
KRBNRvHLlJx
NgE7<<
Y"z~Vz
{d"z_<N\
`VlI"f
fC|sI_
R,+d)k
=6YJoX
9t.u*a
2)3lyq
L`jBdN
K/l[\rf
c9nnK\
Ku`}|'
$h-cd>%?e
b8r|]0
#XlQkL
hqD?BR%
=@u>99
0y^W;z`
]~W((f
E7J]iK3
HjP[rl
,c4y~G
K`hJ9x
M.Qf59a
=j?A-S8
#wf{3,
@{C%LD
,s_(j?
?h e6'[
gzGzBY
jLiG{|Fgi:
snUFkI
(-g}FG
!;sW#6
F"bhk{
%9R!}S
shSsSM
`\$Sy"E
xsz2u^*R
bsKU1}=
#L]<2s
lhDXLw=N
CR+`se
gJiM$d$$d;
cIF8[OII
?jhPFa
g~3S4\8
0]fb)1
{%L#{h
_~`E>|
zc5NOIT
S;(sX0
d^n,%w!
:2v$Po.
w=f\/k.
"tv,-a
~VP|f[
KX(OI3N
o:1A).b6
M#v*=
iFE-&r
@4(iyE
0]m_AL)
h$aQc&
veeE<}
Pytn*Ff
@6"_kc+8\bz
i$-+i]r|
k=*@Q6
VEH#PK
$=DX^j
?'TO/cL#
hFfOeiK"
f<\*e!Do
y;sQJ(oxV:J
poZgrR#
/Jx$o~
bBwFi24
c_\obt=
Xjl,0],
bsRx\Z6s<r8
lpFe~i
k>V;*tI
Q:8[1(
j$ v;nR'
h_QOfY
S0HQpN
z<=#}^4
on^,0F
@.Sa@n
8!B/j1!
.s'iL*SF,
w|LQos
xsV,pn
Mb?G;E?
n>g\nN?
b\3*!3
g?ie-av?
wf]jYK.I
dh$=#_
.<:Sz<J
!83Yzbj
l**no{
~DEK<*Ml
JN}#w(
w9+Qt$
VF1mRq\
T'+Wb`
R 1M:^
H^Y#-{
j&QkP!
?y?;(
39jhbR
@w`>c\
#~eWL-z
imIkLC
KN`8;b89+Y
epuw8X\
?w~wpy
f9WpJB
h]f7'j
R8:>HV9\
FEmqL)*
hE,QoU
%iV=+j
_n\"&[;
,N~EW)
|,x-*;
~7;vFt
?zOtHp
lKl1mZ
kvvZ8xf
b}(<^}
hrHXL~
,'''''''g
DjZy}7
?4u`*<
;'''gL
---=Pu
%'''g_dB
+----=
<>'''''''''''''''''''''gou
y"zpAf
3'''''''''''''g
F"[t}g:9{otl
O"2x\l
X0z27wz
w>PbS_M
)Z$sFl
Z`E0Oz
{,}46~
@\(>@p
{d1y"Vw
=/9# .
)/#3@
z;@{E[
;!&b(P
_KCo*t{
~;ssbB
sPFWnL
hK|+|q
az';`r
/Iz$3*Oy
}P2Mz_jRk
&KchTwf1y
X]cN\U
C2^`w+jwU
iw* `5
Y%l"ip
ggK!1g
*2lVq,
OQ_Oal
;M*3I*
gK'WgD
G{A{G;g
9Id&;$A
dCx/56
!"a iFo
]ZryJ#r
@pKI~O
Z<4^/r
i2_:WSv
X /:dWQ
=X"\q?
#dva@r
r[;rsns~x
~RZji~
5da*Lv
crLB7x
_R^~Fqk
4y_J SB
-3V`4*
^63(;[
Xw+'w_K
mO`4UPu4
#n"+6N
v~-#t~
v=}<@p
KBwU&}
A@x*@D
p7XZ y
fpP^d]
3f%yPm
Aw\%?t
/&c_h=s
jv8(M7
d`ORhr
Cxgtth
<7:HEf
gj>uZa
qg<~Hs
r|d+*R
KS}iKv
%,oWx8
z)F\Ka0
BGVdR9
.Zr:hop
u]0ggtw
wF_`7F[
qIrK 4
er5yK~A
J~Ay r
Oy-9~t
P[Av3!
XPu$qY
9.!u&L
@03r=b)
g[A>#H2;8y
"Zv!qX
}[5[qv:+:
<+4;)4r
hz/72/
!x+e.'
BHQzBV=
O1Gb J
cG3]2F
Tn!ynG
wkFl9"
okfr (
SrB!KB ;
aeZw9}
N"72K}
RZql}q^J
01?OgnG_5Cg
Gc5Lg^F35Pg>GK5Fg
tNG d-@
zzzzmF
Mm[qzz
IIIIIIIIIIII
mNzzzr]
mCzzz'
IIIIIIIIIIII
l xzzIIIIIIIIIIII
xzzIIIIIIIIIII
ulMlzz
xzzIIIIII=
xzzIIIIII
lZ|zz=-
l8yzzIIIIIIIIIIIIIII
yzzIIIIIIIIII
l-qzz=
yzzIIIIIIIIIIIIII
mbbzzF=
yzzIIIIIIIIIIII
mBbzzF=E
x}zAQ|
|z$*xz
&%)\JG
0g}r`[
,`m~vB
,`m~@K
;zG_;z
QzAJDu[
huW9/3
R$@$;"\L
fN;,)l1
AdP'=E
)kU{Ip
\}h%XB
==*YQ+
MA<%K2a
ls6c6wY
?XO:Vl
8zz&}U
*x\Wan
{c.]s7
n=kn_t
t3VD3[
.k.SzU
;ZGnM.z
qcxfm
K(E#-;
6+ASAWs
jE!uaF
@pK=Gqm+`n
tVf<az
I&QPnC
vdT@09'8
`zRa!R
}GcXT|
+#WOQV
5qw#v@
#95VW[iF<
t{QLb@Tz
i;h}U4[
MJd2)B
.OJ,$V
1wE9a6
OTsTVe
nF>bOOqZX
DU,$bP6
"R+>9uu
c?t}}Ef
$c E,:
A<>?*I
wpOv=+
.pG|g5W*L
k(=,uTi4XK
Fr23JJ
fLg=+gY
]:1>Ze
r:sYKTiN
-RG8`3
j;l6d!7
%S)_3'
z-gaGc
e>f2U{
k4jw$\
8+hgjvsD
%pFF0y
QeY-b~]2
)\O=0y
EtRVgf
``QZ+$ =:V6
ySHT1I
*wn)4o
}k9j*Z
+ 8==i
A,LN8=j]
,sS}J[
kBlq~'
>6GspA
NFFMni~
A2M$.NZY9
9`a"FX
rwv*\Z
7.X^<.#
Y#rV
QNG[vG
JH,S}Z7
Ful`g9
|mut^G
Hqky|-
L{hd9x
D[[=sI
I`F2{R
2c-LmKOEm
E5vJj,
b{9=?iQ#
k+dKu}
gHq hC
WlmZEXe
CFv#eH
"dFUO]
5V9]OC0
`j_s9;3M
-2?;lA
/=H=M\
FV]~f,q
]A[B(o
JKs0bp
'*7&I4
EE7f9GA
jTl&Eq
P @jxdH
f?ykDsUv
n:Um+
Lcx&~wg
ca .=h
*1f=*f
L)oses
;03NqN&
}}k:+[
cgW,c w
][<+zV
D,tKim
Csqe`R
(WO6F
fk&X$ #F]p
4}Idhy
7eN=+6wS
Mu4,.B
r*g+l?oe
r7NpwV
)Foa{k3
+=>VRH2"
4}KT:z\
7}<Kq2
ZIhZwz
a`e<nb2*-_G
vcpkr6
K3[Gco)c
v,;l%W
:mtOoz
Ybw5kS
1g$taQm
xC+pF+
a\-jz.W
"tl\F[
-d{yHf%3
Ry^w CWtK
0zzUD6?
'.Y3lJ
.Tf\H$
mlI<6gz4
;UGqKTh,;`
[GR-vjiK4
49#_*X
#)I$u:5
u:KmFH"T
*IuH$f
ZWEfi&
wn#El+
! L{Uf
&#;OLt
^[VgrV0
S]x?ME
&0A$zb
:VoWsX
5mYYC)
='dhOl
\U75kCM
#6 x/
@?.2i<
gy`r?*
L~O%9;
ymK+pW
CbG`cp
,rjH$X
n-|An|
;>xBpG
2Hgdf2
In.Rky
QwsJoK
W-UcJZ
cQY[\j
kh-ZWS
s?O'!CzVsG$.
#o,Sp9
pF0MgqR
Vi\(8b:
9pr=}A
cSg18)
AAn$`s
Y#%IlZ
dVu8U_
Mx%f*#
/sJE-5?
r/-UP?-
gfu*2Kz
7PqvfCj
I7vLp>
xr7Rd@
nXO#0R
% 1^v
6Ejf\xv
]/Bq40
ko}xQ5)YQXa
Wfu5WG
]'QH<9
m'nz-e
"0I(;{
3c SHO
V1w6Z2
&[%Uy#
GdvS][?Ys
Lb@`f8
AP=}ja;
PAsudr
;};WHQR9
]?S0G+
2Eia!i
NKAGDgGc<
XE9}Ve
N6gn!6
T%ec_W
vFw!Li
>[_:\2)
zWl#fr
ZJHrv#
oz.b u
*-t.\Zio
WQit(+KQ
osov-P
:N7v:m}B;
*!9v$7|
UVNTaq
b%{hlE
Q&;t$["
HIrGB8
1ZI^&i
4kC4>*2
wv<2}i<M
bjmrI/
Un5%b?z
{+E!dW
Z6RC,P
{/=+?Z
B=Lj+=
*QqvaElHQ@
#whQ `9*O
u;MZS$
sW't>kj
g F71_
F3QSshF
^Cw=F_
Ikqs[C
U)hUXZG
d*r$AS
f/2k]^
F8Z},a*m
nY/Id^
#C4(~_
#BZN2rOZ
jz#9+0x
a(?)R3
zTS"31_
a@*:-iZ
]Km,<mL
dL4drp?
[e;vuS
J*I\ lt
#-o7;F
~sU{hh
7R=+{hLV
+;3[&Y
RS$sK&
NAw)dr
7dwSKb
s9m$Fe
.2}i1's
Y0d`w7
;FM44_
YZ%?/]
yB%)*$
(8rO O
; lW-q
I1BMhe
aAs,.#
;s]m_S
wwKyde
2GN{sO
aX&s&1
'+h(.Wp
E$pJ6v
we5y+&
j!2\1B
7faf=<c;
6?LzVm+
rI=qS68
y~v{VU
wksyf#
_yA$HI
\/=*S26
5{qsap
O4F6 e{
F2*du(Y
2}MRyYb
V4|Ct-
dIip>c!
U )lw5
?OaW5h
nve{;_>h
~_cU}.CWw2u
M,&UR@
+B07on
]N{czG
}=M}N)8J
Xs(;GV
;,d1_Py
6Asy4`
on-.7K
na?tJe
Id 2.w
gNVgu)
ZWVGJ<
joecy
aOJ.Zz
>RN=+Kji(
u( ;3g
zW}5zg&
,E]X1#
u=*k%di-
,muqaqr
gR7./C
2Oqo ;
4m.ak=
n9=+)m
;WT_:3
jVmkue
7(PFA4
,GQYN:
sDWR`<
ORD?.v.
_xqmT$
{]'AK[6
I]ht7s
f8QUk3
2l<;qPMu
UyEEZg
}k|5e5
+J(f*a
v%ft 0
Gq(U++)
w9=SGo
nmbYI8
u*I[Qm
GCWR60
RD aF3
QcIlW;
Oh%YT#
U5ga't<A
7ro8#6
=?*~Elnh
r(q*:2
5Mb='Gh]J
pDjpI.:
gu9F+S&
Y_2u*;
Fo0;FS;
- xvF[.r
=)GDKZ
CI; 2*!
\I&Ii<
WN<Kc/
us)@Qy9
'A8 4Y
-OV^pGJ
RV"Vr$
`1'#?0
ldrkAI
J2x<{T
>$<pq
aMTas&
eA=MH
(@w)8!
b0r+7t
utOEu's
8WwP\|
OCYRW:
wb1UeS
>rp+CN
N}Mu;#%
ZrWV1WN
W+VgL'us
}B<0 |t5}$I
;hsbctnX
!ssh>I
ecep>m
J *?vy|
;RCd6|
^09 V-
hQW8Py
mRin'y
)u-6uF
9y.Y8U
XLE"2/W
3fsi#oW
o!b9 s
6)RF>`
5JvgB
JzjN$1
kKAm7F
M,9'nz
zT=#sf0
Z2K8b:0
F=ERKan
5BwCz4G
KGsZ-A,
!Ckqq$rHw|
Z!zeF81
r+ZM5c
RWZw9mgf
~S>l4=
P{}*M1
GqDAGc
$8v`8*
qfn'['
\SkCHk
/,]fyJ
09?_jp
J}QwJd
u]Lc$W
xbzTsm\
ZHCleR3
a<f7V!
}Eg7eqr
yjt=QA
H'i_Rj
"%U1nR
QU9]\T
1XSWw.
GZMjiW
M-u-.X
[FWFsV
<""/sj
?6}kl*
JRv2Z;
VgU9_V3
w.sSG6
Zm:K9dI@
TJV,Cm
00zUX4
N#<7=y
Kl\(*NOAU
,0Or)vm
E'sFpy
Lk/0eT
l$&2rF+
,r3V[L
Tbjq2F
M=HkRku
3SSFa'`i9
}EuIh4
y _jRz
;Qkgys"5
]4q[4QFg$
dvz\^i
'@[+$}
$<m^7~
h."UXF\
$k,f2Hw\n
CV-fX>E
E"&Ljz
f[/<Q2
'#i 0=
pp~Pjg
E-t#2I
xdFrr|
L6Km{:
2[4n$M
;UGFMV
Ut&wGYs
qQQu)E"k
L@u`>c
<.VF,H
iD/vMl
s#`ggO
x4\QGGwum
[\i"k4
5jm-nm
So,@E+/O
iK[3ZS
&kHo/"
O!m yU
LmgI>x*
V)]X4r
@G8v\eNx=
3otgVic
DugLuW
HaQ5bS@Y
rNz{T_C9+3
2n<.2kCE
x^]n[}7F
;m+|^~1
sOCKis?P
'<{v5B
<2<Euh
{PD#d1
iq$S&A]
W+:-fKi
5mB$W{RN
Gq]SwE
&L&8_~
e={}k_
wufa?h
F9mKJPg
={S.5F
rZ>T8,
cYIkpKK
Dcu*pW
V(-|=3
gg'sOS
.Gr+)Y2
2+6RvDvM
(Wk?|dQ
rV&RN[-
Hr~t;v
kfkx#Q
FEu^2zu
58BWwB
u TKEcU-D
oOZH''
}1[GF\
km9\oZ
R:M(?(
>(y._cpJ
wLzVci
bsG:E
WzR_\[@
>(MOX}9
qmm;[#
dp2}H5Q_
s<Du*>
P$R02+(a
XGD\uV5
0sYFvV4
Sq^x p
)L$6=GF
-HWHin
h=-lYLr
k{o,%F9^
*2N}k7X
/Sy!Sh
3fYW9|
hIP0pz
YF&Ic~
;hW 8rs
<`}k'P
GCD'fL
}Ip,C8(f
Z}Irqv?
2y5%S #
yX^0S*
ga#g*N1D
pZ2)eI
a;lvt;O
Yu#vs^/
kNIh)+
1t$u?CK
ZFDN7g
I8D9<u5
yLqo?u
p~o@1V
qw4JD7
<7Q^N=
.a5vej
uF7W9g$
m2O2/+x
~Y0Or)
AofV"r>b[>
S[Eq$2J
W K PO
b\nt77
F,OB+q|
:T@RWE
W)t&0?
t?JKre
81T])4
Tg;0}El
1JB!\e
Eg5fZe}Z
#HD}O#=
U 4G*=
g-")0d
2nuo\`c
]~ge\m>
Z9Z$J7V?
G we8Rx
[fVdeE
`2{sYJVF
Gaiii4Q=
EF=:sV,
OBsWEi#
Y%A"rO
9E#?Z?
N??ZjD
bG /_z
M+13?PEl
+6XD,e
)ko4pG
H!pT9
uF6G&.
UbId9B
Bw7Q-Zc
$x*qP#
|K}"Ja
YiiaaD!
}i7d\6?
\rOs\7
$cY^- \
;QQjB\
1Z&fUu
ymppSwO
}u*+@?/%
{t(bb[
dU!6Yv
7Syq)#`
b[ybfP
XvQJd-
o!o1gc
'#f?.i
YuhW;%]
1Y"2Gq
%GsEWer+h}s
FsW}N\
rsS{=JQ
$e>o~8
!!X/?/
J~P2Tu
n>g${U
5+rBLK0
E>M?R1f9
,2d+p}
zRkPz
^av+'$v
|/z s-
?tc=j/
Tt$[4$b@v
ik}92=
z})%qZ
L7Q*/f
*r7v5p
*e-%$
n~I#8>
eyuMRg
a1bH?J
gv{zUs"
nr0H z
'5BI]e(
=;}iG`
V7/tO/r
RFVw"%
2zWKqH
aH~$E<Apcr3
ZRv&1m
MdxOPcj
y7RZ]\7
UzsI
XH=,tG
O>;Q02${
U*v3ul
"gXl~^
}(Y"P-
@;N=k(
ea`H'R
hX/' c
)Rm{QpI
ZXEi.He
V9oA*07
G+9n>V
:i2]Wr
Qio!@FYc
[ib9o^)n
MB]ZKm"
Wdv=8l
wfG62F\
,=GCH]
*}=){4
\F0Cua
Z"=FFU,
OP=MqR
SO[g_1
XTvgG5
3WMiaKDz
tC3+<x
Z>Q7adS
OjKQKr)r
v? QI=
va=Q<n
*9|9<e@
uk"ikr
#w@)gw;Xm`
XSJ,W@
y*\\,H
>h@ON1JH
UJWaR*-2
> ]kZTQ
<A I\ns
Fj{WT(
IY\r;6
00bQK`
QWM49;
J8R,G
#T]/Mck
&$n@5=
UQVdOWcM
01`)C
sj+Ln9
WV=+r
w'`;}j*i#Y
"gyYA;x#
Rp{zT45+
LRV)Kl
+($7QPi7
7dE(,@'(
0%7r*mF
_saUQ\
KrGn+:
ZOGqW\
;.zq]I
`i6eM5
_QPChn
nl-mrb
IjiEnQ
TFE%c>I
u*:2{k
$0 yOQ
vf (pO
S['tM
Qpn|[1
<Ts^I&
5b9$|L$
~nPz z6C
X]C{,On
Xft&Ko*%
?8<dV,
un@5#2
EGdW)eU
_B^e?7!
gq<+}+jk
iyN?!R
GCv"04
xYg jx
UFFTc Z
NKxUmdfE<
pc*:~5
MN;=*@
D>YRF$
Pm=2{V
I_q_A^6
eyo%II
1)Yfw)
Qa'a$uC
`zVuS[
v{;8b\yk
Wb}7pj
AVeKUiw
j,2)$)
'OB!W]
rtbx L
)%~lu^E
6DFMhnx3]
55l2yeWq
8-_h?1
Xd}(LM\
1\#H>U
JQA(Gj
FWYr[%
+)h\_B
?4$B>}
$TfdPw`e{
.g^xjX
1Dcq=J
p^IZB?
i%vDt>
5d~GRZ]
el-atX
%iXYm'
*GRj=,
!RCtR*
^IYPc8
PfK{PI
vik#n2
z}(OBf
Mgl#_65F`
>vFG?7
QF6EywH6
@Lgug7
5tefeQZI
FM8]Gx
6~`=Efx
/~,xOO
==*)@ks
=:_3b:)
^ws{sy/
0GqSUhgSF
N:{T)m>
bYK326p0y
A*E;s6Y
sqnRDTl
SPH2]7
m5*wv:%OK
_Zkas5
EEhni~
@fc+pp
eK#oPz
<S5m.qc%
}+'+3D
8;hE8q
Z#H=OR
6C!n98
WUy^Iu
x7]M2x
]N$b2v
x|Cn$Qw{
;}(FuV
,{Wn%^
G5vo1P
Nk)d70
3Eqwkh^I[i
+>kgv.
A^zGsvDWJ
Q$ZWA##
"mR\az~f
:`VSvw-$
uB)3 S
4Il:=>
(hJvg;"
A+_IOc
${U%tEM
gh^r2N
e5b6 y
lVkRk[
tIL.DD(n
=,7/R!
%deOew
nN=;sNKA
m{eu4f
ZJWw5q
vI.\TY
[y@ci~
)5=/Lt
hcP2O$u
&T 685
Z6z|q4
*#se$L
IX/c>rw
r+WFVx
(|+{u5f
ikst^D
}6v,rI
Em^WFP
e%tAsuup
`W-EgcZk
wnBsX>$
&pN7F-
G@Gzqt
rT ?-KwD
R!+"h
!G,q[zY
)!N9Q
wwhyD I
me\t#
>mBkCwJ
&)Wq`9_cR
~\H>W=
RAU8*}
[C7-lW
^,y%,N
4K3+(M
UAic8;3
9t2<_y%
'=ef:= @
Y8?JKq5
n^3N(M
j)?xK6}
NIceUeN
u)[Q7c
}EK)G[
=* &&}
A(}N}k
)0G.=j
Aw,wR*
)Hv v!K#
lGkpr:
E'bKM#PR\
:HLnX!*8
`]pp3@
<}j[xM
}KXF[4
VA'vy7
D/!ENc
mNY>Ub
3=<t%Qr
E<v4=I
V ryAc
<5O;-.
.Y>~FpTc
`m.>W<
WQwj_N7
YYfI#G
A2.>|g
K`Z @x>
"#!GjKF;
VhX(~C
m7"Ege# g
>GQi#f9$B<
''wAJ"J
,qJZ4*$
GN'5wn
Zvw"N
8^Es{3'Q
?y!nzqDl
AlnPr:/cVm
&=No.v
u#fS{C
_vI9=E/
E3 PgE|
d{{W,e
viNG7z.!
SWsrO=
8g@^@;&{
5yQA3H
JIjgY_r
m9jtKec
iW{a1I
N\\O*k
o_os^&gN
hE~tO,
=EkE^G>*|
s!9b{z}+
f(-JI,Aw
/do2EE
[$Q-BI
RV5eMa
UZ64|;
V7Gv[V
oxwQK=f
+9Vlv&
/jqv8qQ
)jeNVZ
G'2rFi
55EJ7d
T[SHGC
>4[uXM
9efec!
KT9$iS
`S9$zv
6Nzy}=
*_-v (
R]rG^Msz
;-24w8
Th.%;x
tVH#Su(<
]]lXX>rN?
OBM7X{
K pR(k
{Yer>l
SN?#(-
9=r}=+hji
`p0z}k
<Uypp[
uycVbs
voV<~5#*7
:ijDv2n
)DbFl>
{hUV6X
d1 .:V
U6sJ6?
1(?0$a
7bE'w
U)j[Vw %
yZM\or
H.V27r
N>#_k:<>
MeF7ft
.g9*p{v
/G\.k,
*y5~9RF
KTD3,c=
a%fq>,
7qouXZ
j0oW!J
HybzPu!
u$AJM2
aT&U Q
EBV(A\
1\Sw=W"
$}j5vE
}E/wc. c
~#xzWu
"*v;=,
yb;{PW
SVd%uc
'=MI":
O{*Ek"
C;$Ldgv
.d>bFJ
fX7*T`}*T
U7tiGMO3
;uoQ]q
i'f99p
}.;`tWQ
e$b6Es
co, v8
#vKab
S2.?*}
N]~^O+
.$$7 z
<sQM,S
m_R+kfy
Mb+M"r
wSZXlrcpu
SmMSw)-
7.=+Bo
L@N2K~t.>
<imd]|2
}.(|Gi
3*+g(2r
F ,N9<Rk
a]8xZ7;
e(f(XpH
evYI c
j{\'.\E
PWvct .*
p:WAy{
~I$dV_
lep{}=k
ABVG--]
DHe%2J
#mejztZ~
MG]'2G
P~R=1Z
oAiqb4
F&2Vf.
jvW6w-
h=(HJ&
22MsN>
sZ)0t .T
iKnVbA
nrG=(c
~n;{RkQ-
U|+7N{
oqI7v8
ZReSZhY
'5}l]Fi
=McWFi
B;~4_QS
0';O_JaY
IWldv^EgWMJ
kw*Das
u5)hSVW5
m!Mhw^
e'tex"
~t7fkN:
-cXYI/>X
UG=y52Wd
&0>ROS
mFIe:pr
ji-^)G
V#vNrOACZ
$e[+G#(
9jLcq6
g=lc*F
?(nsMj
Nv0ldV
E%&g5mD"
e:WZ u
h5]*Kt
{Hl"U<"(
;)"[KH
veI;#J
)>SjrMjT
%HeVV*T
NW<Le'
G zVRW
FaVP~BpG
InN=kN
5"vZ[K
}{RD^7
E{+T~u
BaS]DX
vKy,Dg
dIj2Kk
\,l7('
.A?.H>
L^4g\>W'
>j.+_RD
G$Uy v
5ero;ac$
vNwf9R
;W;]Br
o>r` td
mb9.mL
?okc$6:
>g'${T
-wk+Kpq
XsshA-
BN6;aI
Wdo02p>
bdV#ny
q;Ojqv&
18|0V<`gw
Z|3yR`*
rCw=EKV
$q#1'
Q}p7})Ei
S!+c,h
,G=1Bz
UU[aTv
|E`US{/
V>FT)T4t
^IU%+#a
+$Pqqz
7%2Tzc
qr07Is
[\8`TH>
**$]6S
Kn5/*I
prW*[+
2Hr>e+
Aqkw+D
sQk=GMu?
2-;{`(8
u+ek6i
wpw}({
??J7En
U\u?rXXJ
\KCIl[
qS'sH-
}*+-+P
1|]yw=
3Pvaok#u
~KI;(c
U@U^2;~5
IshL;X
4wmjvv
FpGLSc
Z6s2@7
.g` #'$o>
;UGLVuu
#VS$Ckp
1-Z>']<F
I5c#[Uu
Fxlc#=k
2wV=3B
qS}R"3
%bp^WLd
iWIn\D
z{U)$edV8+
%Wi#SI
kdU?|7
ypwV?I
?)=kjW
4|"&8?AV
cS'vO5
GN)9 s
qJkC)'
;T(jiRj(}
.23 <{
FZE 2|`
n*hoH_+
:_#m+#|
EYMNC>$`
pDu9!Tt
XTAMs6
gI3*\}
T[]cD$
I?xQ/#Z2
F~W=pjyl
rE:0 /
I.p#8*0x
/cDW0@
O8I @@
jpjzT)
4.Ab2qN'
.zT!"[
n\63 @
^JQDa3
y4_A%q#r
4kEqcpQf
OCIKs:
_q:2C.
OemJI8
+9;+#Zn
\pMsJ6
OSjEy<
V'[O9J
V7R#*4%
lVsVE$
#?gmM9
R7GM?t
RME,Wqm
'hLR]X
[J'*c/$
$` p;U
%bUGsT
m%]XKn
V]JF?q
f0:'$ JA}
O0B7C/uK3
Q!KEcV
:UU$8F
4 :)?6
%>`p2z
$. p51z
};Q5f9i
Yg"yP*
ZGc)+hO
bkwK;$'i
m&{\;U9I
]S^2h~
\I$eQw
0; CYH
2OBsQQjGS/
.FrF?*
MiF6EJvf
.nrW s8
(Bm'${
^Csp-|Kyq9dYNp
(.$/+0
R}ONA+,
w1f pk
Pamx^L
FxR4yc`
b~oOcYs
}kY;")
I&{|9S
xn</.^4
2)Ej)D
Y03DF9?
fOuo#/
%NOnE>k
EmCJy`
<sYTwHv
[T9+N'
;k&}\6#v
tyw>W7
q$+vW#k
oc4?i@F
UWW3}L
~BU67BA
[#TPIL
so(#dj
b;WE}q
b+F0N|
@n@=)4!
Vkgt\;
cvV=1ZS
.z QYJ:X
5&.& |
{fH\nR8
rZ,`$n
WO/A\Y4
,@d<~4
}iIh%'
QZ5ub
ZIu<lC
rntKEsj
V@7m^x
#qg4d#
<Akfcgp
G*=kNB
P(G95n
5eW*2;
jrG *I
-koobt
LU&)=,zW
\j]X)O
{W]*j1G%W
tM=.4;i
On: jSvE-
'nA=H=
XdRZ"7
<j"9y:g
gGD,_hb{w
a+#G-I.
m_A*.a
~&xCPe
7ojno"H
^i7a4$Q9;a
[utbI<
Z[o"X|
'A =N;
l\a=G|Wf
(7; ''
0I<55P
*$9t6WA
cX7wb9l
EbFiKM
&Z"}0*
>3[2^n
}+*Ki$
4,HLV+4
-)n$3c,
W3Me*M
tFWFMw?
XqS%wq
VkyIC
rMkxsP
Ve q^
B{+M*#
gKequh
ZI61P0
<iq$B6
-u}?L{+f
-JUg(F
qSXh3>.C
7]s_{UV
[H'xH9
BiJ|?$.
x%c$rJ
-5Kicx%
$y%f#*OJ
JMwPB
CY@{9]
#c#Ex6
o~![$F
_(GLTKr
,qN(kk
(Wc jB
u0JN0~Q
Gbjk;h
U?/o~;
Oq_5Q{
{XW27R
7;lYK+b
;UQF:{
w~K_\3o
08%z{T
9 JM2Vo
R{U=49
YeLVeMAuG
vsH.9G
KqzA a[
< ZH<T
/<?,1O
6-B[9$Fv
EFm"{X
FWwOjc
ObsN!5
UX34Dgr
b"^ \.
Zp[ fy
f[[ns$
"f8U_Oz
9ot:>K59
n/f*wJ
^y,{Xd
{\?O-d
1Mw&dR
'?7^*x.
<&4bKa
Bm_^I\n
^XW#V.
6{p?ZI-
9^FxLy
n=704l
tzVt_
z`vNw0
xJZ A$Z
,d#Fw|
r\ng'q u>
|9m$qi
>ZjM"!{
XTA5vJ
T:M&GeH
[^+p`R3
fFrzRn
3zzVOr
G\{W[g
b#djJ<
*[!$gr
X}sA;H8
c1U8Rz
)jkNWE
oA^Nn
S2R"0^
zy;zdri
?3ZB79
,S.X4e<
V{{m@[D
Mn.]nP
YD0O$M
E?1J6&
q%N1My
X94t+2
m'h]Cg'
C8;N8>
kREm.G
KeYYr0?SY
ld?,Dz
3'RODW
h`Pw$s
$hFcdV
X.XF9"
YSW;T[
pMqwb(
A\qZ'`R
*%$.}Mi<
rTt JC$)
""nPNx#
: S_>x
FMi{#,:
Ir8<g?
.-GPU6
.zTvZ=
-.wjV.
.%/qm#L
qU[LvW/
{R3 ;p
yS(v0'8
:cAqo"
dB&BOU
e11|}}
ClB^D2
6X!<Wm
e[kKrW
g=+)Ul
c8n7W5
H[.N?\P
Xrj{M=
endstream
endobj
14 0 obj
<</Length 3587/Subtype/XML/Type/Metadata>>stream
<?xpacket begin="
" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.1-c041 52.337767, 2008/04/13-15:41:00 ">
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about=""
xmlns:xmp="http://ns.adobe.com/xap/1.0/">
<xmp:ModifyDate>2010-06-12T00:52:10+08:00</xmp:ModifyDate>
<xmp:CreateDate>2010-06-01T17:20:10+08:00</xmp:CreateDate>
<xmp:MetadataDate>2010-06-12T00:52:10+08:00</xmp:MetadataDate>
<xmp:CreatorTool>Adobe LiveCycle Designer ES 8.2</xmp:CreatorTool>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:format>application/pdf</dc:format>
<dc:title>
<rdf:Alt>
<rdf:li xml:lang="x-default">test</rdf:li>
</rdf:Alt>
</dc:title>
<dc:creator>
<rdf:Bag/>
</dc:creator>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">
<xmpMM:DocumentID>uuid:b80ab715-038b-4006-88aa-0501c8f758c7</xmpMM:DocumentID>
<xmpMM:InstanceID>uuid:ed2770cc-bea9-4b2e-a216-1511c09f7bb5</xmpMM:InstanceID>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:pdf="http://ns.adobe.com/pdf/1.3/">
<pdf:Producer>Adobe LiveCycle Designer ES 8.2</pdf:Producer>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>
<?xpacket end="w"?>
endstream
endobj
15 0 obj
<</Filter/FlateDecode/First 65/Length 259/N 10/Type/ObjStm>>stream
o/fqS]
endstream
endobj
16 0 obj
<</Filter/FlateDecode/First 5/Length 127/N 1/Type/ObjStm>>stream
2204003044
SPL242005B2)
B2KrR5JR
endstream
endobj
17 0 obj
<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<224C58AFBB383842BD3B41CD196C7E5A><73B72ED162E19748865B44E090FB245D>]/Info 37 0 R/Length 99/Root 39 0 R/Size 38/Type/XRef/W[1 3 1]>>stream
endstream
endobj
startxref
Dropped Files
40abf3f5ddc9124c_a9r8152.tmp
| File name | 40abf3f5ddc9124c_a9r8152.tmp |
|---|---|
| File size | 358 bytes |
| File type | PDF document, version 1.6 |
| MD5 | cdb6a2cdd16461ec63437a17cedfaf4d |
| SHA1 | 37f55ce6c0f56bdf7e87a2d74af0eb04804774cb |
| SHA256 | 40abf3f5ddc9124cfc30e9edcb23ee761ddba521dd0466ae4fef7b3946aa2f8f |
| SHA512 | 0e0abdf0eb75b8a420e69183912c66229c6b3cc569f0ada12e349f35b0ab9d5df431dbb235f229a26d20eda2ee2b79518bc087139d7107591cd52d805e826b9b |
| Ssdeep | 6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOu8cQ8c1aCSyAAO:IngVMre9T0HQIDmy9g06JXe8cQ8cMlX |
| Yara | None matched |
| VirusTotal | Search for Analysis |
219b5f11b968ba89_a9r8153.tmp
| File name | 219b5f11b968ba89_a9r8153.tmp |
|---|---|
| File size | 358 bytes |
| File type | PDF document, version 1.6 |
| MD5 | ccec7ceed673e1f3e8b39778fec25948 |
| SHA1 | ea25fc95347d51ab0cf3b9fbfd57c5cb41559022 |
| SHA256 | 219b5f11b968ba890956e5e8e3145afe9c999865166e5afd746158700037fce3 |
| SHA512 | 7b5b0a4d9fa4a59465b4fc96af7373cfa810a328bda3d5123bf83b0e278042c4f65898812064cdb2aac6673570940630831a7b85bed067fe3289b4641e271883 |
| Ssdeep | 6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOHtSUQIX3utSUQIX3umCSyAAO:IngVMre9T0HQIDmy9g06JX3gaXdaX+mR |
| Yara | None matched |
| VirusTotal | Search for Analysis |
b7e552327cfe8c8a_d3d9caps.dat
| File name | b7e552327cfe8c8a_d3d9caps.dat |
|---|---|
| File size | 664 bytes |
| File type | data |
| MD5 | ea798514252ea5c6a690328f132b16b0 |
| SHA1 | b6d61b760d6f7e5ce0d68a4463afa09ee2496680 |
| SHA256 | b7e552327cfe8c8aa42bd3457a853f3c1f9c04f5b41364d818f8cb4435be94e7 |
| SHA512 | 70ef9dd39aca707c4597b84130377c4a3c72fdc8e2e3d28c350917aa1f71a994a3d0306f21381aa81e448e2cdcf6027e864776f98b91b4cdf01c2e416dbedc65 |
| Ssdeep | 3:ZllKbllVnIlqQRi5BBl//lHlljlfltl+lp/5tAalB/AMlGM/JlpllDlHl/lAluoK:8b/+Ni///r1aR5tAanDGM/JuI4llCl |
| Yara | None matched |
| VirusTotal | Search for Analysis |
d90f507188198a72_adobearm.log
| File name | d90f507188198a72_adobearm.log |
|---|---|
| File size | 3030 bytes |
| File type | ASCII text, with CRLF, CR line terminators |
| MD5 | 45f6d4a29f72f3ab78db9d464bdae7c4 |
| SHA1 | 90c00e999bfda437076aaef9f17f1f2dad2245d4 |
| SHA256 | d90f507188198a726f2217f5c2aef4185af5bbae7a2e991b8c2206521bff9321 |
| SHA512 | 10e4225bafe13d43f1e807141e5ab60550124d5961ba9297880353282f64ca78f70a42e60ff248d1dcd2984138e1449eec381d64810415fec3dca8bef45e8da1 |
| Ssdeep | 48:ob17Q2eMbJ5d1rogAafH5L1XQmaI7Z5z1DkieM7t5GJL10JAf3NJwwJQJIYJAJJv:ob1kFmJ5d1sNsH5L1A1aZ5z1A52t5m1D |
| Yara | None matched |
| VirusTotal | Search for Analysis |
a479dd2807cb9817_ArmUI.ini
| File name | a479dd2807cb9817_ArmUI.ini |
|---|---|
| File size | 163994 bytes |
| File type | Little-endian UTF-16 Unicode text, with CRLF line terminators |
| MD5 | 927e703153e62a1cb9a4437659144bda |
| SHA1 | d293a6eb612b6c3bcddeec698e40dbebb5c61879 |
| SHA256 | a479dd2807cb9817ef3ef7a31f3b7582339785e921b4284e55a1387dc38ec770 |
| SHA512 | 0a1d099fccceadb38c7326a9791da18ddeff069600359b415744ae46641b8f041e4a31b00281a996f54b0991dbdf7bdbd0701f6cb71189afd42c207c4631d228 |
| Ssdeep | 3072:kT4CJ4WTbmKk61NmSTBjDT7lV8MztutF4NVxcCXXYAF5CPD:9EYJ |
| Yara | None matched |
| VirusTotal | Search for Analysis |
2a2e0ba33d793244_usercache.bin
| File name | 2a2e0ba33d793244_usercache.bin |
|---|---|
| File size | 9662 bytes |
| File type | data |
| MD5 | 912bc7140ba3596f83450d830b7c9557 |
| SHA1 | 0bae66884a3e091bd6095923d4add3984f3e8db2 |
| SHA256 | 2a2e0ba33d79324445847a0128ca611fcc50c82a3556fa9a1478405f990843d2 |
| SHA512 | e9e45522441f2dfcfb2cd273be300a0b2add972c62f7496326a3fc5c45e4f318ca4d446ae2676360958429e39b91c1a7ee677a95d710d2936d5d48b1854dc3f1 |
| Ssdeep | 96:stIHhqWwdwlvw5SR73kAUVokJUJ0JMSJ81Wkhg28c1qOeN6hLWjAHo+1rOAq8oNs:sHWwdwlvwsR3UVoLpB+OeN6LWwTAAk8 |
| Yara | None matched |
| VirusTotal | Search for Analysis |
cd45143589eed4aa_acecache10.lst
| File name | cd45143589eed4aa_acecache10.lst |
|---|---|
| File size | 1565 bytes |
| File type | data |
| MD5 | 751f3f26ad1d4baaa6c1b54a851f3ff1 |
| SHA1 | b0b1a2263c3688888eafcfca5fd54a1875f0d72b |
| SHA256 | cd45143589eed4aadf9cb930280e99a59088589220addf1125bdfcf9e04db81a |
| SHA512 | c858a2539544075bc6725149758c0e992003dad3ef8bc3486f3ec659ed6dbd326318d3f0f7fca77860bcd0791e1c9d3766dacb6cea4fe690ce536a8dc984051c |
| Ssdeep | 24:ehkFwRfC0yJrZtkRlxFX5C0yJrC3l9XhqXbx8xqdXhqbFBC0yJrZWlV:e/Rq0yZOlY0y0l1heaoVhj0yalV |
| Yara | None matched |
| VirusTotal | Search for Analysis |
60927ce9b1e6e4bc_shareddataevents
| File name | 60927ce9b1e6e4bc_shareddataevents |
|---|---|
| File size | 3072 bytes |
| File type | SQLite 3.x database |
| MD5 | ced3e8a4293014481ed3aa8724cf976e |
| SHA1 | 4cc68cc1cc223e81973f1aa8fe9a938b4b9c08df |
| SHA256 | 60927ce9b1e6e4bc107309d4fccfa46579105c9b212148a3649f3040860bb834 |
| SHA512 | 757bfc9f26bf6a3e60b5a2ea54d326d43d7915e134ea5bc129d5dc8f96284804375db7042020ec7ec3f7d4bc5f557accfae7ee2a25b9c7c69655f0b12b0970ce |
| Ssdeep | 12:HLS0qgtO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qllZ2301NI4h2:r8Rx/XYKQvGJF7ursClZPfI4c |
| Yara | None matched |
| VirusTotal | Search for Analysis |
Network Analysis
Behavior Summary
File-Read
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\PIPE\lsarpc
File-Written
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda
- C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log
- \\?\PIPE\lsarpc
- C:\WINDOWS\system32\d3d9caps.dat
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R8153.tmp
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R8152.tmp
- \\?\PIPE\lsarpc
- C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
- C:\WINDOWS\system32\d3d9caps.tmp
File-Deleted
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
File-Opened
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda
- C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log
- C:\
- \\?\PIPE\lsarpc
- C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\
- C:\
- C:\Documents and Settings\ardi\Application Data\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\
- C:\Program Files\Adobe\Reader 9.0\Resource\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf
- C:\WINDOWS\Web\wallpaper\Bliss.bmp
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB
- C:\WINDOWS\system32\wininet.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf
- C:\WINDOWS\system32\urlmon.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\
- C:\WINDOWS\system32\d3d9caps.tmp
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\
- C:\Program Files\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api
- C:\Documents and Settings\ardi\Local Settings\Temp\100621.pdf
- C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\
- C:\WINDOWS\system32\VBoxDisp.dll
- C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\
- C:\WINDOWS\system32\Macromed\Flash\
- C:\WINDOWS\system32\wdmaud.drv
- C:\WINDOWS\system32\spool\drivers\color\is330.icm
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R8152.tmp
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api
- C:\WINDOWS\system32\rpcss.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\
- C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R8153.tmp
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api
- C:\Program Files\Common Files\Adobe\
- C:\Documents and Settings\ardi\Application Data\desktop.ini
- C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\
- C:\Documents and Settings\ardi\Local Settings\Application Data\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\
- C:\Program Files\Common Files\Adobe\ARM\1.0\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api
- C:\Documents and Settings\ardi\Local Settings\Temp\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\
- C:\WINDOWS\system32
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap
- C:\WINDOWS\system32\rsaenh.dll
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api
- C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm
- C:\Program Files\Common Files\
- C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf
- C:\Documents and Settings\ardi\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\
- C:\Documents and Settings\ardi\Local Settings\Temp
- C:\Program Files\Adobe\Reader 9.0\Resource\Font
- C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V
- C:\WINDOWS\system32\spool\drivers\color\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api
- \\?\PIPE\lsarpc
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api
- C:\WINDOWS\system32\d3d9caps.dat
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api
- C:\Documents and Settings\
- C:\Documents and Settings\ardi\Application Data\Adobe\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api
- C:\Documents and Settings\ardi\Local Settings\
- C:\Program Files\Adobe\Reader 9.0\Reader\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api
Registry Key-Opened
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
- HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\PagedBuffers
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_CURRENT_USER\SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer
Registry Key-Deleted
- HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify
Registry Key-Read
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayName
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAPatching
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\Language\current\(Default)
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\Debug
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\Language
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableUserInstalls
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\AuthorizedLUAApp
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMajor
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer\EULA
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer\Path
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMinor
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetConnectDisconnect
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisablePatch
- HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockDown\bUpdater
Processes
registry filesystem process services network synchronization
lsass.exe PID: 660, Parent PID: 536
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|
AcroRd32.exe PID: 1852, Parent PID: 1804
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 2016-11-03 00:38:03.331915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.481915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.481915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.501915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.501915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.552915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.562915 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.562915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.562915 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.562915 | NtOpenFile |
file_handle => 0x0000006c filepath => \Device\KsecDD desired_access => 0x00100001 filepath_r => \Device\KsecDD open_options => 16 status_info => 0 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:03.562915 | NtOpenFile |
file_handle => 0x00000070 filepath => C:\WINDOWS\system32\wininet.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll open_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.562915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.562915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.562915 | LdrLoadDll |
basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => AcroRd32 module_address => 0x009f0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\WINDOWS\system32\rpcss.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\rpcss.dll open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.572915 | LdrLoadDll |
basename => BIB module_address => 0x07000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.582915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.582915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.582915 | LdrLoadDll |
basename => aiodlite module_address => 0x10000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.582915 | LdrLoadDll |
basename => ADVAPI32 module_address => 0x77dd0000 flags => 0 module_name => C:\WINDOWS\system32\ADVAPI32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:03.582915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:03.582915 | LdrLoadDll |
basename => acrord32 module_address => 0x009f0000 flags => 0 module_name => c:\program files\adobe\reader 9.0\reader\acrord32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.592915 | LdrLoadDll |
basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.592915 | NtOpenFile |
file_handle => 0x000000b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.622915 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.622915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.622915 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.622915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.632915 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.632915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.632915 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.632915 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.632915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.642915 | LdrLoadDll |
basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:38:03.642915 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => C:\WINDOWS\system32\SHELL32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | LdrLoadDll |
basename => SETUPAPI module_address => 0x77920000 flags => 0 module_name => SETUPAPI.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | LdrLoadDll |
basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000f8 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000f8 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000f4 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000f4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.642915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x00000100 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | LdrLoadDll |
basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:03.652915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Common Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.652915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.652915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.662915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.662915 | LdrLoadDll |
basename => gdi32 module_address => 0x77f10000 flags => 0 module_name => gdi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.662915 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.772915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.772915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.772915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.772915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.772915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.782915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.782915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.782915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.822915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.832915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.842915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.852915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.852915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.852915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.882915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.892915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.892915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.892915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.902915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.912915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.922915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.932915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.952915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.962915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:03.962915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.962915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtCreateFile |
create_disposition => 5 file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtWriteFile |
buffer => 4
67
75 FID.1:o: :F:ArialMT P:Arial L:$  "F:Arial # 89 FID.1:o: :F:Arial-ItalicMT P:Arial Italic L:$  ÿ "F:Arial # 85 FID.1:o: :F:Arial-BoldMT P:Arial Bold L:$ ¼ "F:Arial # 98 FID.1:o: :F:Arial-BoldItalicMT P:Arial Bold Italic L:$ ¼ ÿ "F:Arial # 91 FID.1:o: :F:Arial-Black P:Arial Black L:- „ "F:Arial Black # 95 FID.1:o: :F:ComicSansMS P:Comic Sans MS L:-  BF:Comic Sans MS # 105 FID.1:o: :F:ComicSansMS-Bold P:Comic Sans MS Bold L:- ¼ BF:Comic Sans MS # 94 FID.1:o: :F:CourierNewPSMT P:Courier New L:$  1F:Courier New # 108 FID.1:o: :F:CourierNewPS-ItalicMT P:Courier New Italic L:$  ÿ 1F:Courier New # 104 FID.1:o: :F:CourierNewPS-BoldMT P:Courier New Bold L:$ ¼ 1F:Courier New # 117 FID.1:o: :F:CourierNewPS-BoldItalicMT P:Courier New Bold Italic L:$ ¼ ÿ 1F:Courier New # 84 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf # 92 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf # 89 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf # 96 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf # 108 FID.1:o: :F:EstrangeloEdessa P:Estrangelo Edessa L:
 BF:Estrangelo Edessa # 123 FID.1:o: :F:FranklinGothic-Medium P:Franklin Gothic Medium L:$  "F:Franklin Gothic Medium # 136 FID.1:o: :F:FranklinGothic-MediumItalic P:Franklin Gothic Medium Italic L:$  ÿ "F:Franklin Gothic Medium # 79 FID.1:o: :F:Gautami P:Gautami L:8
 F:Gautami # 79 FID.1:o: :F:Georgia P:Georgia L:$  F:Georgia # 93 FID.1:o: :F:Georgia-Italic P:Georgia Italic L:$  ÿ F:Georgia # 89 FID.1:o: :F:Georgia-Bold P:Georgia Bold L:$ ¼ F:Georgia # 102 FID.1:o: :F:Georgia-BoldItalic P:Georgia Bold Italic L:$ ¼ ÿ F:Georgia # 76 FID.1:o: :F:Impact P:Impact L:'
 "F:Impact # 73 FID.1:o: :F:Latha P:Latha L:,  F:Latha # 99 FID.1:o: :F:LucidaConsole P:Lucida Console L:  1F:Lucida Console # 113 FID.1:o: :F:LucidaSansUnicode P:Lucida Sans Unicode L:1  "F:Lucida Sans Unicode # 84 FID.1:o: :F:Mangal-Regular P:Mangal L:6  F:Mangal # 79 FID.1:o: :F:Marlett P:Marlett L: ô F:Marlett # 116 FID.1:o: :F:MicrosoftSansSerif P:Microsoft Sans Serif L:$  "F:Microsoft Sans Serif # 91 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf # 86 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf # 88 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf # 90 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf # 78 FID.1:o: :F:MVBoli P:MV Boli L:4  F:MV Boli # 96 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf # 91 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf # 86 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf # 88 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf # 90 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf # 114 FID.1:o: :F:PalatinoLinotype-Roman P:Palatino Linotype L:+  F:Palatino Linotype # 122 FID.1:o: :F:PalatinoLinotype-Italic P:Palatino Linotype Italic L:+
file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtWriteFile |
buffer =>  ÿ F:Palatino Linotype # 118 FID.1:o: :F:PalatinoLinotype-Bold P:Palatino Linotype Bold L:+ ¼ F:Palatino Linotype # 131 FID.1:o: :F:PalatinoLinotype-BoldItalic P:Palatino Linotype Bold Italic L:+ ¼ ÿ F:Palatino Linotype # 84 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf # 73 FID.1:o: :F:Raavi P:Raavi L:5  F:Raavi # 76 FID.1:o: :F:Shruti P:Shruti L:6  F:Shruti # 79 FID.1:o: :F:Sylfaen P:Sylfaen L:*
 F:Sylfaen # 149 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB M:C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM # 78 FID.1:o: :F:SymbolMT P:Symbol L:'  F:Symbol # 76 FID.1:o: :F:Tahoma P:Tahoma L:'  "F:Tahoma # 86 FID.1:o: :F:Tahoma-Bold P:Tahoma Bold L:' ¼ "F:Tahoma # 105 FID.1:o: :F:TimesNewRomanPSMT P:Times New Roman L:#
 F:Times New Roman # 119 FID.1:o: :F:TimesNewRomanPS-ItalicMT P:Times New Roman Italic L:#
 ÿ F:Times New Roman # 115 FID.1:o: :F:TimesNewRomanPS-BoldMT P:Times New Roman Bold L:# ¼ F:Times New Roman # 128 FID.1:o: :F:TimesNewRomanPS-BoldItalicMT P:Times New Roman Bold Italic L:#
¼ ÿ F:Times New Roman # 93 FID.1:o: :F:TrebuchetMS P:Trebuchet MS L:%  "F:Trebuchet MS # 107 FID.1:o: :F:TrebuchetMS-Italic P:Trebuchet MS Italic L:%  ÿ "F:Trebuchet MS # 103 FID.1:o: :F:TrebuchetMS-Bold P:Trebuchet MS Bold L:% ¼ "F:Trebuchet MS # 114 FID.1:o: :F:Trebuchet-BoldItalic P:Trebuchet MS Bold Italic L:% ¼ ÿ "F:Trebuchet MS # 81 FID.1:o: :F:Tunga-Regular P:Tunga L:5  F:Tunga # 79 FID.1:o: :F:Verdana P:Verdana L:'  "F:Verdana # 93 FID.1:o: :F:Verdana-Italic P:Verdana Italic L:'  ÿ "F:Verdana # 89 FID.1:o: :F:Verdana-Bold P:Verdana Bold L:' ¼ "F:Verdana # 102 FID.1:o: :F:Verdana-BoldItalic P:Verdana Bold Italic L:' ¼ ÿ "F:Verdana # 82 FID.1:o: :F:Webdings P:Webdings L:  F:Webdings # 93 FID.1:o: :F:Wingdings-Regular P:Wingdings L:$  F:Wingdings # 125
6 Symbol
0
48
6 Symbol
1
49
10 AdobePiStd
0
44
8 SymbolMT
1
49
12 Verdana-Bold
1
63
7 Verdana
1
61
5 Arial
1
0
7 ArialMT
1
0
7 Marlett
1
28
12 Arial-BoldMT
1
2
18 Arial-BoldItalicMT
1
3
14 Arial-ItalicMT
1
1
14 CourierNewPSMT
1
7
19 CourierNewPS-BoldMT
1
9
25 CourierNewPS-BoldItalicMT
1
10
17 TimesNewRomanPSMT
1
52
17 LucidaSansUnicode
1
26
13 LucidaConsole
1
25
22 TimesNewRomanPS-BoldMT
1
54
28 TimesNewRomanPS-BoldItalicMT
1
55
9 Wingdings
1
66
24 TimesNewRomanPS-ItalicMT
1
53
17 Wingdings-Regular
1
66
21 CourierNewPS-ItalicMT
1
8
21 PalatinoLinotype-Bold
1
42
7 Gautami
1
18
16 EstrangeloEdessa
1
15
5 Latha
1
24
20 Trebuchet-BoldItalic
1
59
18 TrebuchetMS-Italic
1
57
18 Verdana-BoldItalic
1
64
11 Arial-Black
1
4
11 ComicSansMS
1
5
14 Verdana-Italic
1
62
6 Impact
1
23
16 ComicSansMS-Bold
1
6
16 Arial,BoldItalic
1
3
10 ArialBlack
1
4
15 ComicSansMSBold
1
6
22 MyriadCurrency-Regular
0
35
14 MyriadPro-Bold
0
38
16 MyriadPro-BoldIt
0
39
12 MyriadPro-It
0
37
15 CourierStd-Bold
0
13
22 CourierStd-BoldOblique
0
14
18 CourierStd-Oblique
0
12
10 CourierStd
0
11
14 MinionPro-Bold
0
32
16 MinionPro-BoldIt
0
33
12 MinionPro-It
0
31
17 MinionPro-Regular
0
30
17 MyriadPro-Regular
0
36
12 Georgia-Bold
1
21
18 Georgia-BoldItalic
1
22
7 Georgia
1
19
21 FranklinGothic-Medium
1
16
22 PalatinoLinotype-Roman
1
40
27 FranklinGothic-MediumItalic
1
17
14 Georgia-Italic
1
20
6 MVBoli
1
34
6 Mangal
1
27
14 Mangal-Regular
1
27
5 Raavi
1
45
5 Tunga
1
60
13 Tunga-Regular
1
60
6 Shruti
1
46
7 Sylfaen
1
47
18 MicrosoftSa file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | NtWriteFile |
buffer => nsSerif
1
29
23 PalatinoLinotype-Italic
1
41
6 Tahoma
1
50
27 PalatinoLinotype-BoldItalic
1
43
11 Tahoma-Bold
1
51
8 Webdings
1
65
11 TrebuchetMS
1
56
16 TrebuchetMS-Bold
1
58
11 ArialItalic
1
1
10 Arial,Bold
1
2
15 ArialBoldItalic
1
3
12 Arial,Italic
1
1
9 ArialBold
1
2
16 ComicSansMS,Bold
1
6
10 CourierNew
1
7
16 CourierNewItalic
1
8
17 CourierNew,Italic
1
8
14 CourierNewBold
1
9
15 CourierNew,Bold
1
9
20 CourierNewBoldItalic
1
10
21 CourierNew,BoldItalic
1
10
20 FranklinGothicMedium
1
16
26 FranklinGothicMediumItalic
1
17
27 FranklinGothicMedium,Italic
1
17
13 GeorgiaItalic
1
20
14 Georgia,Italic
1
20
11 GeorgiaBold
1
21
12 Georgia,Bold
1
21
17 GeorgiaBoldItalic
1
22
18 Georgia,BoldItalic
1
22
16 PalatinoLinotype
1
40
22 PalatinoLinotypeItalic
1
41
23 PalatinoLinotype,Italic
1
41
20 PalatinoLinotypeBold
1
42
21 PalatinoLinotype,Bold
1
42
26 PalatinoLinotypeBoldItalic
1
43
27 PalatinoLinotype,BoldItalic
1
43
10 TahomaBold
1
51
11 Tahoma,Bold
1
51
13 TimesNewRoman
1
52
19 TimesNewRomanItalic
1
53
20 TimesNewRoman,Italic
1
53
17 TimesNewRomanBold
1
54
18 TimesNewRoman,Bold
1
54
23 TimesNewRomanBoldItalic
1
55
24 TimesNewRoman,BoldItalic
1
55
17 TrebuchetMSItalic
1
57
18 TrebuchetMS,Italic
1
57
15 TrebuchetMSBold
1
58
16 TrebuchetMS,Bold
1
58
21 TrebuchetMSBoldItalic
1
59
22 TrebuchetMS,BoldItalic
1
59
13 VerdanaItalic
1
62
14 Verdana,Italic
1
62
11 VerdanaBold
1
63
12 Verdana,Bold
1
63
17 VerdanaBoldItalic
1
64
18 Verdana,BoldItalic
1
64
0 0 0 0 file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:03.972915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:03.972915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:04.002915 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 2 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x0000011c filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\is330.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.012915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.012915 | NtWriteFile |
buffer => CPSA Ù jTdoogì C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm €sø’‘|ÿÿÿÿüÛ ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|h3( xà Ø rncs BGR baL à TFSM| desc RICOH RUSSIAN-SC 040402 ÿþ R I C O H R U S S I A N - S C 0 4 0 4 0 2 RICOH RUSSIAN-SC 040402 ð8 doog) C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icm sø’‘|ÿÿÿÿüÛ ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|h3( xà Ø rtnm BGR baL ÃŽ 2 TFSM¹ desc KODAK DC Series Digital Camera þÿ K O D A K D C S e r i e s D i g i t a l C a m e r a KODAK DC Series Digital Camera ħ doogÃœ C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|h3( xà Ø rtnm BGR ZYX TRCÃŽ 1 TFSMl desc sRGB IEC61966-2.1 sRGB IEC61966-2.1 ?Ú.ÛJ‰«`¢<_|}Âà H file_handle => 0x00000118 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | CoInitializeSecurity | SUCCESS | ||||
| 2016-11-03 00:38:04.022915 | LdrLoadDll |
basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | LdrLoadDll |
basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.022915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.032915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.042915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.052915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.052915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.062915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.072915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.072915 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.072915 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtCreateFile |
create_disposition => 2 file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.092915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:04.102915 | LdrLoadDll |
basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe |
SUCCESS | |||
| 2016-11-03 00:38:04.102915 | LdrLoadDll |
basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe |
SUCCESS | |||
| 2016-11-03 00:38:04.112915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:04.112915 | NtOpenFile |
file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.112915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\100621.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\100621.pdf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.112915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\100621.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\100621.pdf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.112915 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.132915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtCreateFile |
create_disposition => 2 file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.132915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtOpenFile |
file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.142915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.142915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:04.152915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.152915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.202915 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.313915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.343915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.353915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.363915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.363915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.363915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.363915 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.383915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.383915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.383915 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:38:04.383915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.383915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.393915 | LdrLoadDll |
basename => AXE8SharedExpat module_address => 0x10000000 flags => 0 module_name => AXE8SharedExpat.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.393915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.393915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.393915 | LdrLoadDll |
basename => AXSLE module_address => 0x02cb0000 flags => 0 module_name => AXSLE.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.403915 | NtOpenFile |
file_handle => 0x0000016c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.403915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000016c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.403915 | NtOpenFile |
file_handle => 0x0000016c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.403915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000016c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.413915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.413915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.413915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000170 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.413915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000170 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.423915 | LdrLoadDll |
basename => cryptocme2 module_address => 0x03ca0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.423915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.423915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.423915 | LdrLoadDll |
basename => ccme_base module_address => 0x03d50000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.423915 | LdrLoadDll |
basename => cryptocme2 module_address => 0x03ca0000 flags => 0 module_name => .\cryptocme2.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.423915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.423915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.433915 | LdrLoadDll |
basename => ccme_base module_address => 0x03d50000 flags => 0 module_name => .\ccme_base.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.443915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\entropy desired_access => 0x80100080 file_attributes => 128 filepath_r => entropy create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.503915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.503915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.503915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.503915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.503915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.503915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.563915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.573915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.583915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.593915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.603915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.613915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.613915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.613915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.613915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.623915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.623915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.623915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.623915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.643915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.643915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.643915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.643915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.673915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.683915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.693915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.723915 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:38:04.733915 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.743915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.753915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:38:04.763915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.783915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.793915 | LdrLoadDll |
basename => PPKLite.api module_address => 0x28000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api |
SUCCESS | |||
| 2016-11-03 00:38:04.803915 | NtOpenFile |
file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.803915 | NtOpenFile |
file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.803915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:04.803915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:04.803915 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8152.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8152.tmp create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:04.803915 | NtWriteFile |
buffer => %PDF-1.6
%âãÃÓ
1 0 obj
<</Pages 2 0 R/Type/Catalog>>
endobj
2 0 obj
<</Count 0/Kids[]/Type/Pages>>
endobj
3 0 obj
<<>>
endobj
xref
0 4
0000000000 65535 f
0000000016 00000 n
0000000061 00000 n
0000000107 00000 n
trailer
<</Size 4/Root 1 0 R/Info 3 0 R/ID[<B1D2F646D1BF454B88C4756D1999B04C><B1D2F646D1BF454B88C4756D1999B04C>]>>
startxref
127
%%EOF
file_handle => 0x00000178 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:04.803915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8152.tmp desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8152.tmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | LdrLoadDll |
basename => icuuc36 module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icuuc36.dll |
FAILURE | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.813915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.823915 | LdrLoadDll |
basename => icucnv36 module_address => 0x4a800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.823915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.823915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.823915 | LdrLoadDll |
basename => icudt36_cjk module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icudt36_cjk.dll |
FAILURE | |||
| 2016-11-03 00:38:04.833915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.833915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.833915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.833915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.833915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.833915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtOpenFile |
file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.873915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.883915 | LdrLoadDll |
basename => ATMLIB module_address => 0x73c20000 flags => 0 module_name => ATMLIB.dll |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.893915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.893915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:04.903915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.913915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:04.924915 | NtOpenFile |
file_handle => 0x00000188 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.244915 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.254915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000190 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 2144 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.254915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000190 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.394915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.394915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.394915 | LdrLoadDll |
basename => AdobeXMP module_address => 0x03c10000 flags => 0 module_name => AdobeXMP.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.394915 | LdrLoadDll |
basename => AdobeXMP module_address => 0x03c10000 flags => 0 module_name => AdobeXMP.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.404915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.404915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.404915 | LdrLoadDll |
basename => Accessibility.api module_address => 0x29800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api |
SUCCESS | |||
| 2016-11-03 00:38:05.424915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.424915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.424915 | LdrLoadDll |
basename => rt3d module_address => 0x24a80000 flags => 0 module_name => rt3d.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.424915 | NtOpenFile |
file_handle => 0x00000194 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.424915 | LdrLoadDll |
basename => D3D8 module_address => 0x6d9a0000 flags => 0 module_name => D3D8.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.434915 | LdrLoadDll |
basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.434915 | NtOpenFile |
file_handle => 0x0000000c filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.434915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.englanguage.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.englanguage.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.434915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.434915 | NtOpenFile |
file_handle => 0x00000194 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.434915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.434915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.434915 | LdrLoadDll |
basename => 2d.x3d module_address => 0x07f20000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.444915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng2d.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng2d.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.444915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.444915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.454915 | LdrLoadDll |
basename => 3difr.x3d module_address => 0x06fa0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.454915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng3difr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng3difr.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.454915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.454915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.454915 | LdrLoadDll |
basename => drvDX9.x3d module_address => 0x25300000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.454915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvDX9.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvDX9.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.464915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.464915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.464915 | LdrLoadDll |
basename => drvSOFT.x3d module_address => 0x0ff60000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.464915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvSOFT.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvSOFT.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.464915 | LdrLoadDll |
basename => MSVFW32 module_address => 0x75a70000 flags => 0 module_name => MSVFW32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:05.464915 | LdrLoadDll |
basename => DCIMAN32 module_address => 0x73bc0000 flags => 0 module_name => DCIMAN32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | LdrLoadDll |
basename => prcr.x3d module_address => 0x25490000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.494915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engprcr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engprcr.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | LdrLoadDll |
basename => tesselate.x3d module_address => 0x07fe0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d |
SUCCESS | |||
| 2016-11-03 00:38:05.494915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engtesselate.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engtesselate.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x000001b4 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.494915 | LdrLoadDll |
basename => d3d9 module_address => 0x4fdd0000 flags => 0 module_name => d3d9.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.494915 | NtOpenFile |
file_handle => 0x000001c0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.504915 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.504915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.534915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.554915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.574915 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 5 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtWriteFile |
buffer => file_handle => 0x000001b4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtWriteFile |
buffer => î€ ï¾ | file_handle => 0x000001b4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtWriteFile |
buffer => | ƒ 0á èõ4Ҏ·×¯ýÃC ¯ÂÈ5 ÿÿ ÿÿ ÿ þÿ ÿÿ €? € à < Xg ¤ file_handle => 0x000001b4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.574915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.584915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.584915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.584915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001b4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.584915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001c4 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.584915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:05.715915 | CoCreateInstance |
class_context => 4 clsid => {b22d0c7b-1e65-4533-97fa-a7335b8bcd94} iid => {8ca6c1bb-be62-4739-80ab-d5ecc7605358} |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | LdrLoadDll |
basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32 |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x0000026c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | NtOpenFile |
file_handle => 0x00000278 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | LdrLoadDll |
basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.715915 | NtOpenFile |
file_handle => 0x0000027c filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000280 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000280 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000280 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000280 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000278 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000280 filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtWriteFile |
buffer => file_handle => 0x00000280 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtWriteFile |
buffer => î€ ï¾ | file_handle => 0x00000280 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtWriteFile |
buffer => | ƒ 0á èõ4Ҏ·×¯ýÃC ¯ÂÈ5 ÿÿ ÿÿ ÿ þÿ ÿÿ €? P Â… < è ¤ file_handle => 0x00000280 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtOpenFile |
file_handle => 0x00000278 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x00010080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | NtOpenFile |
file_handle => 0x00000278 filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x00110080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp open_options => 2113568 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:05.725915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.735915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.735915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.735915 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\WINDOWS\system32\urlmon.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll open_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.735915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.735915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.735915 | LdrLoadDll |
basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.735915 | LdrLoadDll |
basename => DSOUND module_address => 0x73f10000 flags => 0 module_name => C:\WINDOWS\system32\DSOUND.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.785915 | LdrLoadDll |
basename => dbghelp module_address => 0x59a60000 flags => 0 module_name => dbghelp.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.785915 | LdrLoadDll |
basename => authplay module_address => 0x30000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | CoCreateInstance |
class_context => 3 clsid => {275c23e2-3747-11d0-9fea-00aa003f8646} iid => {275c23e1-3747-11d0-9fea-00aa003f8646} |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.cfg desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.cfg create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | NtOpenFile |
file_handle => 0x00000294 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.795915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.805915 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002a8 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002a8 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | LdrLoadDll |
basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002ac filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.815915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002ac filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | LdrLoadDll |
basename => rsaenh module_address => 0x68000000 flags => 0 module_name => rsaenh.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.845915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\TTB7APY6 create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:05.845915 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.945915 | LdrLoadDll |
basename => WINMM module_address => 0x76b40000 flags => 0 module_name => C:\WINDOWS\system32\WINMM.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.965915 | LdrLoadDll |
basename => Secur32 module_address => 0x77fe0000 flags => 0 module_name => Secur32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.965915 | LdrLoadDll |
basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.965915 | NtOpenFile |
file_handle => 0x000002cc filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.965915 | LdrLoadDll |
basename => schannel module_address => 0x767f0000 flags => 0 module_name => C:\WINDOWS\system32\schannel.dll |
SUCCESS | |||
| 2016-11-03 00:38:05.975915 | NtOpenFile |
file_handle => 0x00000310 filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:05.995915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:05.995915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:05.995915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:05.995915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:05.995915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:05.995915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:06.005915 | LdrLoadDll |
basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x0000031c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.005915 | NtOpenFile |
file_handle => 0x0000031c filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000033c filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000033c filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => WINTRUST module_address => 0x76c30000 flags => 0 module_name => WINTRUST.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000340 filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000334 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000334 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000338 filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.015915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.015915 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.025915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.025915 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:38:06.035915 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.035915 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.035915 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.035915 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.085915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.085915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:06.085915 | LdrLoadDll |
basename => BIBUtils module_address => 0x22060000 flags => 0 module_name => BIBUtils.dll |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtOpenFile |
file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:06.095915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.018915 | NtOpenFile |
file_handle => 0x00000388 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.038915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:08.038915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:08.038915 | LdrLoadDll |
basename => sqlite module_address => 0x22090000 flags => 0 module_name => sqlite.dll |
SUCCESS | |||
| 2016-11-03 00:38:08.038915 | NtCreateFile |
create_disposition => 3 file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtCreateFile |
create_disposition => 3 file_handle => 0x00000390 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtWriteFile |
buffer => ÙÕù ¡c× kõëT file_handle => 0x00000390 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtWriteFile |
buffer => file_handle => 0x00000390 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x0000038c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtWriteFile |
buffer =>
file_handle => 0x0000038c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtWriteFile |
buffer =>
ü ü file_handle => 0x0000038c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtOpenFile |
file_handle => 0x00000390 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.048915 | NtOpenFile |
file_handle => 0x0000039c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:08.058915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:08.058915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => ÙÕù ¡c× !]dš file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer =>
file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => !]dš file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => !]dß file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtOpenFile |
file_handle => 0x000003a8 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtOpenFile |
file_handle => 0x000003a8 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.058915 | NtWriteFile |
buffer => file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003a0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtWriteFile |
buffer =>
¸ ¸ F M ) X$€f6f8f910150303459d5712abf03951ccAVGeneralLastExitNormal file_handle => 0x000003a0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtWriteFile |
buffer => ÙÕù ¡c× þâÂz file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtWriteFile |
buffer => ÙÕù ¡c× H.k% file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.068915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtWriteFile |
buffer => ÙÕù ¡c× ¼yh file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtWriteFile |
buffer => ÙÕù ¡c× ³¯?3 file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.078915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.088915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.168915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.168915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.168915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.168915 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:08.328915 | LdrLoadDll |
basename => Wtsapi32 module_address => 0x76f50000 flags => 0 module_name => Wtsapi32.dll |
SUCCESS | |||
| 2016-11-03 00:38:08.709915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:08.739915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:08.919915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:09.049915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:09.110915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:09.290915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:09.881915 | NtOpenFile |
file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:09.881915 | NtOpenFile |
file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:09.881915 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:38:09.881915 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:38:09.881915 | NtCreateFile |
create_disposition => 5 file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8153.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8153.tmp create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:09.881915 | NtWriteFile |
buffer => %PDF-1.6
%âãÃÓ
1 0 obj
<</Pages 2 0 R/Type/Catalog>>
endobj
2 0 obj
<</Count 0/Kids[]/Type/Pages>>
endobj
3 0 obj
<<>>
endobj
xref
0 4
0000000000 65535 f
0000000016 00000 n
0000000061 00000 n
0000000107 00000 n
trailer
<</Size 4/Root 1 0 R/Info 3 0 R/ID[<489DE1FF9E71514B9CDB4B03B86A4284><489DE1FF9E71514B9CDB4B03B86A4284>]>>
startxref
127
%%EOF
file_handle => 0x000003b0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:09.881915 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8153.tmp desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8153.tmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003bc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont open_options => 16385 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003b8 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003bc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts open_options => 16385 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003c0 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x000003cc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:10.882915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:38:17.602915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:17.602915 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:38:17.602915 | LdrLoadDll |
basename => Updater.api module_address => 0x30800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api |
SUCCESS | |||
| 2016-11-03 00:38:17.622915 | NtOpenFile |
file_handle => 0x000003c8 filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ARM\1.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:17.662915 | CreateProcessInternalW |
thread_identifier => 696 thread_handle => 0x00000408 process_identifier => 1368 current_directory => C:\Documents and Settings\ardi\Local Settings\Temp filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe track => 1 command_line => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath_r => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe creation_flags => 67109904 process_handle => 0x00000404 inherit_handles => 0 |
SUCCESS | |||
| 2016-11-03 00:38:17.662915 | ShellExecuteExW |
parameters => /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" filepath_r => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" show_type => 10 |
SUCCESS | |||
| 2016-11-03 00:38:18.583915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000408 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:23.210915 | LdrLoadDll |
basename => msimg32 module_address => 0x76380000 flags => 0 module_name => msimg32.dll |
SUCCESS | |||
| 2016-11-03 00:38:27.206915 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000408 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:39:04.029915 | NtDelayExecution |
skipped => 0 milliseconds => 60000 |
SUCCESS |
AdobeARM.exe PID: 1368, Parent PID: 1852
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 2016-11-03 00:38:18.959990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.959990 | NtQuerySystemInformation |
information_class => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00bb0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 8192 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb1000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x004549b4 function_name => FlsAlloc |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x004549a8 function_name => FlsGetValue |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x0045499c function_name => FlsSetValue |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x00454994 function_name => FlsFree |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb3000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80aeba function_name => IsProcessorFeaturePresent |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | SetUnhandledExceptionFilter | SUCCESS | ||||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 524288 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00bc0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bc0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 12288 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb4000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | GetSystemMetrics |
index => 11 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | GetSystemMetrics |
index => 12 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | GetSystemMetrics |
index => 2 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | GetSystemMetrics |
index => 3 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | GetCursorPos |
y => 98 x => 938 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | RegCloseKey |
key_handle => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | NtOpenFile |
file_handle => 0x00000094 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtQueryInformationFile |
file_handle => 0x00000094 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | NtClose |
handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | SetErrorMode |
mode => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | SetErrorMode |
mode => 32775 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8154ec function_name => CreateActCtxW |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a6d4 function_name => ActivateActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a705 function_name => DeactivateActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.959990 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:38:18.959990 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | FindResourceW |
module_handle => 0x00400000 name => #3585 type => #6 |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | SetWindowsHookExW |
thread_identifier => 696 callback_function => 0x00425fb1 module_address => 0x00000000 hook_identifier => 4294967295 |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | LdrGetDllHandle |
module_name => user32.dll module_address => 0x7e410000 |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | LdrGetProcedureAddress |
ordinal => 0 module => USER32 module_address => 0x7e410000 function_address => 0x7e4299cb function_name => NotifyWinEvent |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000094 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoRun reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoDrives reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => RestrictRun reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoNetConnectDisconnect reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetConnectDisconnect |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoRecentDocsHistory reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoClose reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegCloseKey |
key_handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:38:18.969990 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Network options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.969990 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.979990 | SHGetFolderPathW |
token_handle => 0x00000000 dirpath_r => C:\Program Files\Common Files flags => 0 owner_handle => 0x00000000 dirpath => C:\Program Files\Common Files folder => 43 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | GetFileVersionInfoSizeW |
filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb7000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | GetFileVersionInfoW |
buffer => è4 V S _ V E R S I O N _ I N F O ½ïþ ? H S t r i n g F i l e I n f o $ 0 4 0 9 0 4 e 4 V C o m p a n y N a m e A d o b e S y s t e m s I n c o r p o r a t e d j ! F i l e D e s c r i p t i o n A d o b e R e a d e r a n d A c r o b a t M a n a g e r 0 F i l e V e r s i o n 1 . 5 . 7 . 0 :
I n t e r n a l N a m e A d o b e A R M . e x e B
O r i g i n a l F i l e n a m e A d o b e A R M . e x e b ! P r o d u c t N a m e A d o b e R e a d e r a n d A c r o b a t M a n a g e r 4 P r o d u c t V e r s i o n 1 . 5 . 7 . 0 D V a r F i l e I n f o $ T r a n s l a t i o n äFE2X Ž filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => kernel32.dll module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c813100 function_name => GetUserDefaultUILanguage |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130c8 function_name => GetSystemDefaultUILanguage |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8154ec function_name => CreateActCtxW |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a6d4 function_name => ActivateActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a705 function_name => DeactivateActCtx |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | CreateActCtxW |
application_name => module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:38:18.979990 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:38:18.979990 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:38:18.979990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:38:18.989990 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | LdrLoadDll |
basename => AdobeARMLOC module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMLOC.dll |
FAILURE | |||
| 2016-11-03 00:38:18.989990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.989990 | GetTempPathW |
dirpath => C:\DOCUME~1\ardi\LOCALS~1\Temp\ |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | NtOpenFile |
file_handle => 0x00000098 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | NtQueryInformationFile |
file_handle => 0x00000098 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | NtCreateFile |
create_disposition => 3 file_handle => 0x00000098 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\AdobeARM.log create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | GetFileType |
file_handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 2 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 2 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.989990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb8000 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | GetTimeZoneInformation | SUCCESS | ||||
| 2016-11-03 00:38:18.989990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.989990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtWriteFile |
buffer =>
[2016-11-03 05:58:19] Adobe ARM 1.5.7.0 logging started.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] Command Line: /PRODUCT:Reader /VERSION:9.0 /MODE:2
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | GetTempPathW |
dirpath => C:\DOCUME~1\ardi\LOCALS~1\Temp\ |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x0000009c regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x0000009c value => éÂ|À‘|ÿÿÿÿ»‘|ÿþ€| µþ€| ¨ó @SÃ…c à <ó R˾c ó I Œþ Àšƒ| regkey_r => DisableUserInstalls reg_type => 1241832 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableUserInstalls |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => Œ œ ·¼cÿÿÿÿhï Pï € Ø à @ñ |ï O·¼cÿÿÿÿ à € ß à èò regkey_r => Debug reg_type => 1240876 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\Debug |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegEnumValueW |
index => 0 key_handle => 0x000000a0 value => regkey_r => 68AB67CA7DA73301B7449A0500000010 reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000\ç²ï™ˆç²|쀀 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => 9 regkey_r => VersionMajor reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMajor |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => 5 regkey_r => VersionMinor reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMinor |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => 9.5.0 regkey_r => DisplayVersion reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayVersion |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => Adobe Reader 9.5.0 regkey_r => DisplayName reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayName |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb9000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => C:\Program Files\Adobe\Reader 9.0\ regkey_r => Path reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer\Path |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000a0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => acrord32.dll regkey_r => reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\Language\current\(Default) |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => 1033 regkey_r => Language reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\Language |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:18.999990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegQueryValueExW |
key_handle => 0x000000a0 value => 0 regkey_r => AuthorizedLUAApp reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\AuthorizedLUAApp |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] ProductCode: {AC76BA86-7AD7-1033-7B44-A95000000001}
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] ProductName: Adobe Reader 9.5.0
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:18.999990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] ProductVersion: 9.5.0
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] ProductUACPatching: disabled
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | RegEnumValueW |
index => 1 key_handle => 0x000000a0 value => regkey_r => reg_type => 1242440 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000\(Default) |
FAILURE | |||
| 2016-11-03 00:38:19.009990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | FindResourceW |
module_handle => 0x00000000 name => #131 type => ARM_UI_INI |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | LoadResource |
module_handle => 0x00000000 resource_handle => 0x00484998 pointer => 0x00484df0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | SizeofResource |
module_handle => 0x00000000 resource_handle => 0x00484998 resource_size => 163994 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtCreateFile |
create_disposition => 5 file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtWriteFile |
buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ]
B G R = !2J@720=5 AJA AJ@2J@0. . .
C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . .
C H S = ck(WÞÂÂ¥c
g¡RhV. . .
C H T = ck(W#ÂÚ}óÂ:O
ghV. . .
C Z E = P Yi p o j o v á n à k  s e r v e r u &
D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . .
D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . .
E N U = C o n n e c t i n g t o s e r v e r . . .
E S P = C o n e c t a n d o a l s e r v i d o r . . .
E T I = S e r v e r i g a ü h e n d a m i n e . . .
E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . .
F R A = C o n n e x i o n a u s e r v e u r . . .
H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . .
H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . .
I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . .
J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . .
K O R = ļÃÃ… ðÅ°¬ É. . .
L T H = J u n g i a m a s i p r i e s e r v e r i o . . .
L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . .
N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . .
N O R = K o b l e r t i l s e r v e r . . .
P O L = Ac z e n i e z s e r w e r e m . . .
P T B = C o n e c t a n d o a o s e r v i d o r . . .
R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . .
R U S = >4:;NG5=85 : A5@25@C&
S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . .
S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . .
S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . .
S V E = A n s l u t e r t i l l s e r v e r . . .
T U R = S u n u c u y a b a l a n 1l 1y o r . . .
U K R = V4:;NG5==O 4> A5@25@0. . .
[ I D S _ A C T I O N _ E X T R A C T I N G ]
B G R = 72;8G0=5 =0 D09;>25. . .
C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . .
C H S = ck(WÃcÖS‡eöN. . .
C H T = ck(W÷dÖS”jHh. . .
C Z E = E x t r a h o v á n às o u b o r o. . .
D A N = U d t r æ k k e r f i l e r . . .
D E U = D a t e i e n w e r d e n e x t r a h i e r t . . .
E N U = E x t r a c t i n g f i l e s . . .
E S P = E x t r a y e n d o a r c h i v o s . . .
E T I = F a i l i d e e k s t r a k t i m i n e . . .
E U Q = F i t x a t e g i a k a t e r a t z e n . . .
F R A = E x t r a c t i o n d e s f i c h i e r s . . .
H R V = I z d v a j a n j e d a t o t e k a . . .
H U N = F á j l o k k i b o n t á s a . . .
I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . .
J P N = Õ0¡0¤0ë0’0½búQ-N. . .
K O R = Ó|Ç UŕÃDÇ xԔ² É. . .
L T H = I at r a u k i a m o s r i n k m e n o s . . .
L V I = I z g ks t f a i l u s . . .
N L D = B e s t a n d e n u i t p a k k e n . . .
N O R = P a k k e r u t f i l e r . . .
P O L = W y d z i e l a n i e p l i k ó w . . .
P T B = E x t r a i n d o a r q u i v o s . . .
R U M = S e e x t r a g f i _i e r e l e . . .
R U S = 72;5G5=85 D09;>2&
S K Y = E x t r a h u j ú s a s ú b o r y . . .
S L V = E k s t r a h i r a n j e d a t o t e k . . .
S U O = P u r e t a a n t i e d o s t o j a . . .
S V E = E x t r a h e r a r f i l e r . . .
T U R = D o s y a l a r a y 1k l a n 1y o r . . .
U K R = 8;CG5==O D09;V2. . .
[ I D S _ A C T I O N _ I N S T A L L I N G ]
B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . .
C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . .
C H S = ck(W‰[ňôf°e ÿ÷‹
zI{Ã QR file_handle => 0x000000a0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bba000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbb000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | GetFileAttributesW |
file_attributes => 32 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbc000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.009990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x0018e000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.019990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.029990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.039990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.049990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x000f003f base_handle => 0x80000001 key_handle => 0x000000a0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegDeleteValueW |
key_handle => 0x000000a0 regkey_r => iNotify regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.060990 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda desired_access => 0x40100080 file_attributes => 0 filepath_r => \??\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda create_options => 96 status_info => 4294967295 share_access => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | NtQuerySystemInformation |
information_class => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\PagedBuffers regkey_r => Software\Microsoft\Rpc\PagedBuffers options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExA |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc regkey_r => Software\Microsoft\Rpc options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegQueryValueExA |
key_handle => 0x000000a0 value => ó regkey_r => MaxRpcSize reg_type => 160 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle regkey_r => Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc regkey_r => Software\Policies\Microsoft\Windows NT\Rpc options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | GlobalMemoryStatusEx | SUCCESS | ||||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x0018f000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | LdrLoadDll |
basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtDuplicateObject |
handle_attributes => 0 source_process_identifier => 1368 source_handle => 0xfffffffe target_process_identifier => 1368 desired_access => 0x00000000 target_process_handle => 0xffffffff target_handle => 0x000000b0 source_process_handle => 0xffffffff options => 2 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | GetComputerNameW |
computer_name => ARDI-658FEFD2A5 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtDuplicateObject |
handle_attributes => 0 source_process_identifier => 1368 source_handle => 0x000000b4 target_process_identifier => 1368 desired_access => 0x00000000 target_process_handle => 0xffffffff target_handle => 0x000000bc source_process_handle => 0xffffffff options => 2 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000c4 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 23 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 30 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000c4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00190000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtReadFile |
file_handle => 0x000000c4 buffer => D ¸¸ \PIPE\lsass ]ˆŠë ɟè +H` length => 1024 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | NtClose |
handle => 0x000000c4 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | CreateThread |
thread_identifier => 1492 function_address => 0x0043547a flags => 0 parameter => 0x00bbbdb0 stack_size => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.060990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000c8 value => 1 regkey_r => EULA reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer\EULA |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000c8 value => regkey_r => DisablePatch reg_type => 1244768 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisablePatch |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000c8 value => regkey_r => DisableLUAPatching reg_type => 1244768 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAPatching |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] Admin User, IsElevated returns 1
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000cc regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown regkey_r => SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000cc value => ðǂ regkey_r => bUpdater reg_type => 1244748 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockDown\bUpdater |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegCloseKey |
key_handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] Found CommandLine preference AUTO_DOWNLOAD.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000cc regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000cc value => Ÿ»Ÿ»DLG_ERR IDS_MSGBOX_ERR_TITLE IDS_PROXY_AUTH_TITLE IDS_PROXY_AUTH_USERNAME IDS_PROXY_AUTH_PASSWORD IDS_PROXY_AUTH_CHECKBOX IDS_TITLE_CHECKING IDS_TITLE_COMPLETE_SUCCESS IDS_TITLE_INSTALLING_UPDATES IDS_TITLE_NOT_UPDATED IDS_TITLE_READY_TO_DOWNLOAD IDS_TITLECBEAλλO_UPGRADE IDS_TITLE_UPGRADE_INSTALLATION IDS_INFO_UPGRADE IDS_INFO_UPGRADE_X IDS_WHATS_NEW_URL IDS_CHECK_NOTIFY IDS_BTN_REMIND_ME_LATER IDS_BTN_EXIT regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbd000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegQueryValueExW |
key_handle => 0x000000cc value => 9524054672thsnY01000000D08C9DDF0115D1118C7A00C04FC297EB010000003CA587FD8788D9499C6A2997DBC8F641000000002800000045006E0063007200790070007400650064002000620079002000410064006F00620065002E00000003660000A8000000100000008DE3C07C54D0679C9D471ED5707CF7070000000004800000A00000001000000003CE99FC971236D8BEB9D2DC6E4687CB1800000053AFB594D4FC3F84A947CEA58ABDFE166BECDDFFA6712035140000007A73572F02735C97BF61A419014E5915045D83EA regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegCloseKey |
key_handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | CryptUnprotectData |
description => Encrypted by Adobe. buffer => 1 4 7 8 1 0 2 3 7 3 flags => 1 entropy => t h s n |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.070990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] Time elapsed is less than time limit - returning 0
[2016-11-03 05:58:19] Error Code: 120300
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.070990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.070990 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000c8 filepath => \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda desired_access => 0x40100080 file_attributes => 0 filepath_r => \??\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda create_options => 96 status_info => 1 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtWriteFile |
buffer => É file_handle => 0x000000c8 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.070990 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 23 |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | NtDelayExecution |
skipped => 0 milliseconds => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | GetFileAttributesW |
file_attributes => 32 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:38:19.080990 | SetFileAttributesW |
file_attributes => 128 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | DeleteFileW |
filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | GetFileAttributesW |
file_attributes => 4294967295 filepath_r => filepath => |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | GetFileAttributesW |
file_attributes => 4294967295 filepath_r => filepath => |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000c8 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | RegQueryValueExW |
key_handle => 0x000000c8 value => Ÿ»DLG_ERR IDS_MSGBOX_ERR_TITLE IDS_PROXY_AUTH_TITLE IDS_PROXY_AUTH_USERNAME IDS_PROXY_AUTH_PASSWORD IDS_PROXY_AUTH_CHECKBOX IDS_TITLE_CHECKING IDS_TITLE_COMPLETE_SUCCESS IDS_TITLE_INSTALLING_UPDATES IDS_TITLE_NOT_UPDATED IDS_TITLE_READY_TO_DOWNLOAD IDS_TITLEBŘ 耘»Ï»Ŗ è³í¾ IDÅ• 안»è³í¾á”ᇑŒRŠ취»è³í¾á”ᇑ窌쀀ì‰î®— ꔼﶇ‡SŠ쾀» Cleanup... UŇ 춰»è³í¾á”ᇑ窌쀀ì‰î®— ꔼﶇ袇䧙檜霩죛䇶 (I ľ ìŸÂ» IsLongTimeNoUpdates... Ä· Conn regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | RegQueryValueExW |
key_handle => 0x000000c8 value => 9524054672thsnY01000000D08C9DDF0115D1118C7A00C04FC297EB010000003CA587FD8788D9499C6A2997DBC8F641000000002800000045006E0063007200790070007400650064002000620079002000410064006F00620065002E00000003660000A8000000100000008DE3C07C54D0679C9D471ED5707CF7070000000004800000A00000001000000003CE99FC971236D8BEB9D2DC6E4687CB1800000053AFB594D4FC3F84A947CEA58ABDFE166BECDDFFA6712035140000007A73572F02735C97BF61A419014E5915045D83EA regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | CryptUnprotectData |
description => Encrypted by Adobe. buffer => 1 4 7 8 1 0 2 3 7 3 flags => 1 entropy => t h s n |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.100990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.100990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] ARM returns ERROR_SUCCESS
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:38:19.100990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtAllocateVirtualMemory |
process_identifier => 1368 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtWriteFile |
buffer => [2016-11-03 05:58:19] Adobe ARM 1.5.7.0 logging finished.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | UnhookWindowsHookEx |
hook_handle => 0x000700af |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x000000c4 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | RegOpenKeyExW |
access => 0x000f003f base_handle => 0x80000001 key_handle => 0x000000c0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | RegDeleteValueW |
key_handle => 0x000000c0 regkey_r => iNotify regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | RegCloseKey |
key_handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 8192 process_handle => 0xffffffff base_address => 0x00cc0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => mscoree.dll module_address => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => mscoree.dll module_address => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 0 process_handle => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 0 process_handle => 0x00000000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 327680 process_handle => 0xffffffff base_address => 0x00c40000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000090 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | GetSystemMetrics |
index => 31 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrUnloadDll |
library => uxtheme module_address => 0x5ad70000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x0000008c |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000080 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 8192 process_handle => 0xffffffff base_address => 0x00a60000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000068 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000060 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x0000005c |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000058 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x003f0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x003e0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 8192 process_handle => 0xffffffff base_address => 0x003c0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000054 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 8192 process_handle => 0xffffffff base_address => 0x003d0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | RegCloseKey |
key_handle => 0x00000050 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtUnmapViewOfSection |
process_identifier => 1368 region_size => 8192 process_handle => 0xffffffff base_address => 0x003b0000 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x0000004c |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000044 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | SetUnhandledExceptionFilter | SUCCESS | ||||
| 2016-11-03 00:38:19.100990 | NtOpenKey |
key_handle => 0x00000044 desired_access => 0x00020019 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtQueryValueKey |
key_handle => 0x00000044 key_name => value => reg_type => 0 information_class => 2 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000044 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000040 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1368 process_handle => 0xffffffff base_address => 0x00000000 size => 0 |
FAILURE | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000010 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtClose |
handle => 0x00000020 |
SUCCESS | |||
| 2016-11-03 00:38:19.100990 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 1368 process_handle => 0xffffffff |
FAILURE |